Privacy notice
What we process, why, for how long, and how you exercise your rights — written plainly.
On this page
1. Who the controller is
This notice is provided under Article 13 of the GDPR and, for data subjects in Türkiye, Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK).
- Legal name
- __TICARET_UNVANI__
- Address
- __ADRES__
- Tax office / number
- __VERGI_DAIRESI_VE_NO__
- Trade registry (MERSİS)
- __MERSIS_NO__
- Data controllers' registry (VERBİS)
- __VERBIS_NO__
- __KVKK_EPOSTA__
- Phone
- __TELEFON__
- EU representative (GDPR Art. 27)
- __AB_TEMSILCISI__
See also the data request page.
2. Two roles
provengine processes personal data in two different capacities, and its obligations differ accordingly. This distinction governs the rest of the notice.
| Situation | provengine acts as | Controller |
|---|---|---|
| Visiting this website | Controller | provengine |
| Creating an account, accepting an invitation | Controller | provengine |
| Doing work inside your employer's organisation | Processor | The employer who created the organisation |
The third row matters: for your task records, your answers and the photos you upload, the controller is the organisation that employs you, and provengine processes them on its behalf and on its instructions. Requests about that data go to your organisation first; provengine cannot decide them on its own, only make them technically possible.
3. Personal data processed
3.1 When you visit this website
This site sets no cookies, runs no tracking scripts and makes no request to a third-party server. Every asset, fonts included, is served from provengine's own infrastructure. Server access logs technically contain an IP address, a timestamp, the requested path and browser information; these are kept for security and fault diagnosis only and are never used for marketing. See the cookie policy.
3.2 When you use the application
- Identity and contact: first name, last name, email address
- Membership: your organisation and team memberships, your role
- Task records: tasks assigned to you, the answers you give, the photos you upload, start and submission times, your comments
- Consent records: the version, date, IP address and browser information of the consent you gave to this notice
- Device: a mobile push token, so notifications can be delivered
For photo evidence the principle of proportionality is binding: a requested photo must document the object of the work, not the worker.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Assigning, recording and approving work | 6(1)(b) — performance of a contract |
| A manager monitoring team performance | 6(1)(f) — legitimate interests |
| Sending task notifications | 6(1)(b) |
| Storing photo evidence | 6(1)(f), with explicit consent obtained |
| Account creation and authentication | 6(1)(b) |
| Statutory retention and evidentiary duties | 6(1)(c) — legal obligation |
| Site security and fault diagnosis | 6(1)(f) |
Your data is not used for advertising, profiling or automated decision-making, and is never sold.
5. Recipients and international transfers
| Recipient | Purpose | Location |
|---|---|---|
| agentechauth | Authentication and email delivery | __AGENTECHAUTH_KONUM__ |
| fiload | File storage (photos and documents) | __FILOAD_KONUM__ |
| Expo Push | Mobile notification delivery | United States |
| __BARINDIRMA_SAGLAYICI__ | Server hosting | __BARINDIRMA_KONUM__ |
Expo Push is located outside Türkiye and the EEA. For that reason a notification body never carries a person's name; only the task or team name is transferred. Notifications can be switched off entirely in the app's settings. The transfer relies on __YURTDISI_AKTARIM_DAYANAGI__.
6. Retention and destruction
| Data | Retention |
|---|---|
| Task records and answers | 24 months by default; the organisation sets 3–120 months |
| Task photos | 24 months by default; the organisation sets 3–120 months |
| Activity and audit log | At least 24 months — cannot be shortened |
| Notification inbox | 6 months |
| System email log | 12 months |
| Consent records | Membership + 10 years (evidentiary duty) |
| Declined or expired invitations | 3 months |
Periodic destruction runs monthly, and every run is logged.
7. Your rights
You have the right to:
- Know whether your personal data is being processed, and obtain information about it (Art. 15)
- Receive your data in a machine-readable, portable format (Art. 20)
- Have inaccurate or incomplete data corrected (Art. 16)
- Have your data erased where the conditions are met (Art. 17)
- Have processing restricted (Art. 18)
- Object to processing based on legitimate interests (Art. 21)
- Be informed of the third parties to whom your data has been transferred
- Not be subject to a decision based solely on automated processing (Art. 22)
- Withdraw consent at any time, without affecting processing already carried out (Art. 7(3))
- Lodge a complaint with a supervisory authority (Art. 77) or, in Türkiye, with the Personal Data Protection Board
Several of these can be exercised directly in the application:
| Right | How |
|---|---|
| Access and portability | Machine-readable (JSON) export from the account screen |
| Rectification | Profile update from the account screen |
| Erasure | Deletion request from the account screen — held for 30 days and cancellable in that window |
| Objection and everything else | Data request page |
Requests are answered within 30 days at the latest.
8. Security of processing
- All external traffic is encrypted with TLS
- Access is role-based and follows least privilege
- The existence of a record you may not see is not disclosed to you
- Your password is not stored by provengine; it is held by the identity provider
- File access verifies ownership and task authorisation separately
- Answer values, email bodies and file contents are never written to system logs
- Every state transition and administrative action is written to an audit log
In the event of a personal data breach, the supervisory authority is notified within 72 hours and affected data subjects without undue delay.
9. Changes to this notice
This notice is versioned. When a new version is published you are asked to consent again in the application, and your consent is stored together with the version it was given for. The version in force is printed at the top of this page.